The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.
A flaw was found in the way the Hotspot component in OpenJDK verified bytecode from the class files. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2014-6601 to this issue.
Multiple improper permission check issues were discovered in the JAX-WS, and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2015-0412 and CVE-2015-0408 to these issues.
A flaw was found in the way the Hotspot garbage collector handled phantom references. An untrusted Java application or applet could use this flaw to corrupt the Java Virtual Machine memory and, possibly, execute arbitrary code, bypassing Java sandbox restrictions. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2015-0395 to this issue.
A flaw was found in the way the DER (Distinguished Encoding Rules) decoder in the Security component in OpenJDK handled negative length values. A specially crafted, DER-encoded input could cause a Java application to enter an infinite loop when decoded. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2015-0410 to this issue.
A flaw was found in the way the SSL 3.0 protocol handled padding bytes when decrypting messages that were encrypted using block ciphers in cipher block chaining (CBC) mode. This flaw could possibly allow a man-in-the-middle (MITM) attacker to decrypt portions of the cipher text using a padding oracle attack. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2014-3566 to this issue.
It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption being enabled. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2014-6593 to this issue.
An information leak flaw was found in the Swing component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2015-0407 to this issue.
A NULL pointer dereference flaw was found in the MulticastSocket implementation in the Libraries component of OpenJDK. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2014-6587 to this issue.
Multiple boundary check flaws were found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could allow an untrusted Java application or applet to disclose portions of the Java Virtual Machine memory. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2014-6585 and CVE-2014-6591 to these issues.
Multiple insecure temporary file use issues were found in the way the Hotspot component in OpenJDK created performance statistics and error log files. A local attacker could possibly make a victim using OpenJDK overwrite arbitrary files using a symlink attack. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2015-0383 to this issue.
More information about these vulnerabilities can be found in the security advisory issued by Red Hat:
| Product: | Affected Version(s): | Risk Level: | Actions: |
|---|---|---|---|
| Avaya Aura® Experience Portal | 7.0 thru 7.0.2 | Low | Install Linux Patch 2015-10 or later. |
| Avaya IP Office Server Edition | 9.0 thru 9.1.3 | Medium | Upgrade to 9.1.4 or later. |
| Avaya IP Office Application Server | 9.0 thru 9.1.3 | Medium | Upgrade to 9.1.4 or later. |
| Avaya one-X® Client Enablement Services | 6.2 thru 6.2 SP3 | Medium | Upgrade to 6.2 SP4 or later. |
| Avaya Session Border Controller for Enterprise | 6.3.x | Medium | Upgrade to 7.0 or later. |
Recommended Actions for System Products:
Avaya strongly recommends following networking and
security best practices by implementing firewalls, ACLs,
physical security or other appropriate access restrictions.
Though Avaya believes such restrictions should always be in
place, risk to Avaya products and the surrounding network
from this potential vulnerability may be mitigated by
ensuring these practices are implemented until such time as
an Avaya provided product update or the recommended Avaya
action is applied.
Further restrictions as deemed necessary based on the
customer's security policies may be required during this
interim period, but the System Product operating system or
application should not be modified unless the change is
approved by Avaya. Making changes that are not approved may
void the Avaya product service contract.
When determining risk, Avaya takes into account many factors as outlined by Avaya's Security Vulnerability Classification Policy. The following table describes factors that mitigate the risk of specific vulnerabilities for affected Avaya products:
| Vulnerability | Mitigating Factors |
|---|---|
|
CVE-2014-6585 CVE-2014-6587 CVE-2014-6591 CVE-2014-6601 CVE-2015-0395 CVE-2015-0407 CVE-2015-0408 CVE-2015-0412 |
These are a Low risk for Experience Portal because java-1.7.0-openjdk is not used by
default. These are a Low risk for all other listed products because execution of untrusted Java applications or applets is not possible without non-standard direct user interaction. |
|
CVE-2014-3566 CVE-2014-6593 |
These are a Low risk for Experience Portal because java-1.7.0-openjdk is not used by
default. These are a Medium risk for all other listed products because of the potential for a Man in the Middle attacker to obtain sensitive data used for secure communication. |
| CVE-2015-0383 | This is a Low risk for Experience Portal because java-1.7.0-openjdk is not used by
default. This is a Low risk for all listed products because the Hotspot component is not used by default. |
|
CVE-2015-0410 |
This is a Low risk for Experience Portal because java-1.7.0-openjdk is not used by
default. This is a Low risk for all other listed products because untrusted DER-encoded input is not allowed without non-standard direct user interaction. |
Avaya software-only products operate on general-purpose operating systems. Occasionally vulnerabilities may be discovered in the underlying operating system or applications that come with the operating system. These vulnerabilities often do not impact the software-only product directly but may threaten the integrity of the underlying platform.
In the case of this advisory Avaya software-only products are not affected by the vulnerability directly but the underlying Linux platform may be. Customers should determine on which Linux operating system the product was installed and then follow that vendor's guidance.
| Product: | Actions: |
|---|---|
| Avaya Aura® Experience Portal | Depending on the Operating System installed, the affected package may be installed on the underlying Operating System supporting the EP application. |
Recommended Actions for Software-Only Products:
In the event that the affected package is installed, Avaya recommends following recommended actions supplied by Red Hat regarding their Enterprise Linux.
Additional information may also be available via the Avaya support website and through your Avaya account representative. Please contact your Avaya product support representative, or dial 1-800-242-2121, with any questions.
ALL INFORMATION IS BELIEVED TO BE CORRECT AT THE TIME OF PUBLICATION, IS PROVIDED "AS IS", AND IS APPLICABLE ONLY TO PRODUCT VERSIONS ELIGIBLE FOR MANUFACTURER SUPPORT IN ACCORDANCE WITH AVAYA PRODUCT LIFE CYCLE POLICY. AVAYA INC., ON BEHALF ITSELF AND ITS SUBSIDIARIES AND AFFILIATES (HEREINAFTER COLLECTIVELY REFERRED TO AS "AVAYA"), DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AND FURTHERMORE, AVAYA MAKES NO REPRESENTATIONS OR WARRANTIES THAT THE STEPS RECOMMENDED WILL ELIMINATE SECURITY OR VIRUS THREATS TO CUSTOMERS' SYSTEMS. IN NO EVENT SHALL AVAYA BE LIABLE FOR ANY DAMAGES WHATSOEVER ARISING OUT OF OR IN CONNECTION WITH THE INFORMATION OR RECOMMENDED ACTIONS PROVIDED HEREIN, INCLUDING DIRECT, INDIRECT, INCIDENTAL, STATUTORY, CONSEQUENTIAL DAMAGES, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF AVAYA HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
THE INFORMATION PROVIDED HERE DOES NOT AFFECT THE SUPPORT AGREEMENTS IN PLACE FOR AVAYA PRODUCTS. SUPPORT FOR AVAYA PRODUCTS CONTINUES TO BE EXECUTED AS PER EXISTING AGREEMENTS WITH AVAYA.
V 1.0 - February 24, 2015 - Initial Statement issued.
V 2.0 - October 16, 2015 - Updated all the products affected versions and
actions, and set advisory status to final.
Avaya customers or Business Partners should report any security issues found with Avaya products via the standard support process.
Independent security researchers can contact Avaya at
[email protected].
Linux® is the registered trademark of Linus Torvalds in the U.S. and other countries.
© 2015 Avaya Inc. All Rights Reserved. All trademarks identifying Avaya products by the ® or ™ are registered trademarks or trademarks, respectively, of Avaya Inc. All other trademarks are the property of their respective owners.